An Internal Runtime Race: AnyIO process‑pool workers launch child processes with standard error connected to a pipe that the parent never drains, despite documentation claiming all streams are redirected. The worker code can write attacker‑controlled data to sys.stderr, which fills the pipe and blocks the worker before it can send back its normal out‑of‑band signal. As a result, the calling coroutine awaiting the process‑pool call never receives the standard‑output protocol response and remains blocked indefinitely. The flaw is a classic memory resource exhaustion defect, mapped to CWE‑770, that can be leveraged to cause application sit‑busy behavior and deny service to legitimate users.

All systems running AnyIO prior to version 4.14.2 are exposed. Vendors listed include agronholm:anyio, with affected releases below 4.14.2. Any code paths that spawn process‑pool workers and run code that might produce high stderr output are vulnerable. The bug remedy is available in release 4.14.2.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is not provided, and the vulnerability is not listed in CISA KEV, implying no confirmed exploits yet. The attack vector requires a process‑pool worker that writes large amounts of data to its standard error stream – this may naturally arise from untrusted or buggy worker code. If such a scenario occurs, the blocking can persist forever, leading to denial of service. Prompt upgrade mitigates risk entirely.